#!/bin/sh

freebsd-update fetch
freebsd-update install

pkg install -y portupgrade portsnap mc bash vim nano doas fusefs-ext2 fusefs-ntfs dsbmc dsbmd pulseaudio xorg noto git kde5 sddm

# portsnap fetch extract
# portsnap fetch update
# portupgrade -af --batch

chsh -s /usr/local/bin/bash root
chsh -s /usr/local/bin/bash alex
pw usermod alex -G wheel
pw usermod alex -G operator
pw usermod alex -L russian

mkdir backups

cp /boot/loader.conf backups/loaders.conf.bak
cp /etc/rc.conf backups/rc.conf.bak
cp /etc/sysctl.conf backups/sysctl.conf.bak

cat >> /boot/loader.conf << EOF
hw.vga.textmode=0
kern.ipc.shmseg=1024
kern.ipc.shmmni=1024
kern.maxproc=100000
mmc_load="YES"
mmcsd_load="YES"
sdhci_load="YES"
fuse_load="YES"
coretemp_load="YES"
amdtemp_load="YES"
tmpfs_load="YES"
aio_load="YES"
libiconv_load="YES"
libmchain_load="YES"
cd9660_iconv_load="YES"
msdosfs_iconv_load="YES"
EOF

cat >> /etc/sysctl.conf << EOF
kern.sched.preempt_thresh=224
vfs.usermount=1
hw.snd.default_auto=0
EOF

sysrc sshd_enable="YES"
sysrc ntpd_enable="YES"
sysrc ntpd_flags="-g"
sysrc powerd_enable="YES"
sysrc powerd_flags="-a hiadaptive -b adaptive"
sysrc hcsecd_enable="YES"
sysrc sdpd_enable="YES"
sysrc devfs_system_ruleset="devfsrules_common"
sysrc polkit_enable="YES"
sysrc kld_list="fuse ext2fs cuse"
sysrc dsbmd_enable="YES"
sysrc pf_enable="YES"
sysrc dbus_enable="YES"
sysrc sddm_enable="YES"

cat >> /etc/devfs.conf << EOF
kern.sched.preempt_thresh=224
vfs.usermount=1
hw.snd.default_unit=`cat /dev/sndstat | grep default | cut -c 4`
hw.snd.default_auto=0
EOF

cat >> /etc/devfs.conf << EOF
perm    /dev/acd0       0666
perm    /dev/acd1       0666
perm    /dev/cd0        0666
perm    /dev/cd1        0666
perm    /dev/da0        0666
perm    /dev/da1        0666
perm    /dev/da2        0666
perm    /dev/da3        0666
perm    /dev/da4        0666
perm    /dev/da5        0666
perm    /dev/pass0      0666
perm    /dev/xpt0       0666
perm    /dev/uscanner0  0666
perm    /dev/video0     0666
perm    /dev/tuner0     0666
perm    /dev/dvb/adapter0/demux0    0666
perm    /dev/dvb/adapter0/dvr       0666
perm    /dev/dvb/adapter0/frontend0 0666
EOF

cat >> /etc/devfs.rules << EOF
[devfsrules_common=7]
add path 'ad[0-9]\*' mode 666
add path 'ada[0-9]\*' mode 666
add path 'da[0-9]\*' mode 666
add path 'acd[0-9]\*' mode 666
add path 'cd[0-9]\*' mode 666
add path 'mmcsd[0-9]\*' mode 666
add path 'pass[0-9]\*' mode 666
add path 'xpt[0-9]\*' mode 666
add path 'ugen[0-9]\*' mode 666
add path 'usbctl' mode 666
add path 'usb/\*' mode 666
add path 'lpt[0-9]\*' mode 666
add path 'ulpt[0-9]\*' mode 666
add path 'unlpt[0-9]\*' mode 666
add path 'fd[0-9]\*' mode 666
add path 'uscan[0-9]\*' mode 666
add path 'video[0-9]\*' mode 666
add path 'tuner[0-9]*' mode 666
add path 'dvb/\*' mode 666
add path 'cx88*' mode 0660
add path 'cx23885*' mode 0660
add path 'iicdev*' mode 0660
add path 'uvisor[0-9]*' mode 066
add path 'dri/*' mode 0666 group wheel
EOF

cat >> /etc/pf.conf << EOF
ext_if="re0"
tcp_services = "{ssh, https}"
udp_services = "{60000:60010}"
icmp_types = "{echoreq, unreach}"
icmp6_types="{echoreq, unreach, 133, 134, 135, 136, 137}"
tcp_state="flags S/SA keep state"
udp_state="keep state"
set block-policy drop
set skip on lo0
scrub in on \$ext_if all fragment reassemble
block in log all
pass out quick modulate state
antispoof for \$ext_if inet
antispoof for \$ext_if inet6
block in from urpf-failed to any
block in quick on \$ext_if from any to 255.255.255.255
pass in on \$ext_if inet proto tcp from any to any port \$tcp_services \$tcp_state
pass in on \$ext_if inet6 proto tcp from any to any port \$tcp_services \$tcp_state
pass in on \$ext_if inet proto udp from any to any port \$udp_services \$udp_state
pass in on \$ext_if inet6 proto udp from any to any port \$udp_services \$udp_state
pass inet proto icmp all icmp-type \$icmp_types keep state
pass inet6 proto icmp6 all icmp6-type \$icmp6_types keep state
EOF

echo "permit keepenv :alex" >> /usr/local/etc/doas.conf
echo "proc /proc procfs rw 0 0" >> /etc/fstab

service pf start
service sddm start